modules/Makefile.am: move syslogformat to the beginning of the list of compiled modules

Because other modules depending on it would not compile (such as csvparser unit test).

Signed-off-by: Balazs Scheidler <bazsi@balabit.hu>
csvparser, basicfuncs, cryptofuncs: compile the module first, and then recurse into tests

Fixes build when make check is invoked in a pristine build directory.

Signed-off-by: Balazs Scheidler <bazsi@balabit.hu>
configure.in: fixed --with-librabbitmq-client option to match shell variable name

The name of the option was incorrectly given, causing the shell variable
that contains the command line value to be unset even if the option
was specified in the configure command line.

Signed-off-by: Balazs Scheidler <bazsi@balabit.hu>
dbparser: added basicfuncs as a dlpreload module to the unit tests

Since $(context-length) is now being used by the dbparser unit tests,
and otherwise the unit tests wouldn't be able to run in a non-installed
environment.

Signed-off-by: Balazs Scheidler <bazsi@balabit.hu>
test_logproto: use the canonical names for utf8 and ucs4

Since our build environments were pruned to the least amount of stuff,
the aliases for utf-8 are not recognized. Change the character names
to "utf-8" and "ucs-4", these work without the aliases being available.

Signed-off-by: Balazs Scheidler <bazsi@balabit.hu>
tgz2build/rules: disable amqp and rabbitmq from the build

Since my test build environment is Debian etch based, rabbitmq doesn't
build as it needs a newer Python. Disable it for now.

Signed-off-by: Balazs Scheidler <bazsi@balabit.hu>
logproto: Introduce an indented multiline server class

The indented multiline class is derived from LogProtoTextServer, the
main difference is in determining what constitutes a full line: while
the text server considers a newline as a terminator, the indented
multiline server has stricter requirements: the newline must be
followed by another line that does not start with whitespace.

Signed-off-by: Gergely Nagy <algernon@balabit.hu>
Add an "indented-multiline" logreader flag

Teach logreader to accept "indented-multiline" as a flag, so that
affile and afsocket can look for it, and set the proto to
indented-multiline instead of text if the flag's found.

Signed-off-by: Gergely Nagy <algernon@balabit.hu>
linux-kmsg-format: New format plugin to parse /dev/kmsg messages

With linux 3.5, /dev/kmsg was changed substantially, and it now emits
structured kernel messages towards userspace. For its format, see
Documentation/ABI/testing/dev-kmsg in a recent kernel source.

This format plugin implements the parser for that format, including
special parsing for the DEVICE keys, and resolving of the message
timestamps on Linux.

To use it on a 3.5+ kernel, something along these lines should replace
the /proc/kmsg source:

  file("/dev/kmsg"
       flags(kernel, indented-multiline)
       program-override("kernel")
       format("linux-kmsg"));

Signed-off-by: Gergely Nagy <algernon@balabit.hu>
affile: Treat /dev/kmsg on linux specially

On Linux, use a dgram reader for /dev/kmsg, because it works almost
exactly like a dgram source anyway, and a dgram reader is more
efficient than the indented-multiline one.

Also, change the system() source to not enforce indentedn-multiline on
/dev/kmsg anymore, since with the change to affile, there's no need
to.

Signed-off-by: Gergely Nagy <algernon@balabit.hu>
system-source: Add Linux 3.5+ /dev/kmsg support

When on Linux, and /dev/kmsg is seekable, use that over /proc/kmsg,
using indented-multiline and the linux-kmsg format.

Signed-off-by: Gergely Nagy <algernon@balabit.hu>
linux-kmsg: Store the unresolved timestamp too

Resolving the timestamp may be inaccurate (due to suspend/resume), so
store the monotonic timestamp too.

Signed-off-by: Gergely Nagy <algernon@balabit.hu>